b2c-organic-social-media-marketing

SUSPICIOUS: the core coaching content is benign and aligned, but the skill crosses into autonomous public-posting territory and explicitly installs a second skill that adds external API/CLI trust. Install provenance looks same-org and npm-based rather than overtly malicious, so this is not confirmed malware; the main concerns are transitive skill installation and enabling agent-driven social posting.